use cors globally to allow for OPTIONS requests